Thousands of Mobile Apps Leak Data from Firebase Databases
Ionut Arghire | June 20, 2018
Thousands of mobile applications running on iOS and Android have exposed over 113 gigabytes of data from 2,300 unsecured Firebase databases, enterprise mobile security firm Appthority says in a new report. The new research follows last year’s report into the HospitalGown attack vector, which revealed that more than 1,000 mobile apps on enterprise devices were exposing potentially sensitive data via insecure connections with backend servers. Similar to the HospitalGown vulnerability, which was found in mobile applications’ architecture and infrastructure, the new security flaw resides in mobile app developers failing to require authentication to a Google Firebase cloud database. One of the most popular backend database technologies for mobile apps, Firebase does not secure user data by default. It does not warn developers when data is not secure and does not provide third-party encryption tools either. To ensure data is secure, app builders need to specifically implement user authentication on all database tables and rows, but that rarely happens, Appthority explains in a report (PDF). Because of that, an attacker can easily find open Firebase app databases and access private records. The security issue, which the security firm refers to as the Firebase vulnerability, has a huge impact, leaking 100 million records (113 gigabytes) of data from unsecured Firebase databases. After digging through millions of applications, the security researchers discovered 28,502 mobile apps (27,227 Android and 1,275 iOS apps) connected to a Firebase database, 3,046 of which (10.69%) were found vulnerable (2,446 Android and 600 iOS apps).